Latest News About 2017 Equifax Data Breach

Here are the latest publicly available updates on the 2017 Equifax data breach as of 2026:

• Settlement progress and consumer relief: The U.S. regulators’ multi-agency settlement from 2019 remains the cornerstone of consumer redress, with up to $700 million in monetary relief and penalties. Payments for eligible claims (including out-of-pocket losses and free credit monitoring) have continued under the settlement framework, with ongoing oversight by regulators. This settlement was designed to address unfair and deceptive practices related to the breach and to impose security improvements on Equifax [CFPB/FTC/States settlement details and ongoing consumer relief cited by regulators].[2][9][10]

• Breach mechanics and scope: The breach affected roughly 147 million people in the U.S. (with additional affected individuals in the UK and Canada, though numbers vary by report) and occurred through unauthorized access to a web application used for online disputes, with attackers exploiting a vulnerability in a widely known Apache Struts CVE in 2017. Equifax later disclosed the breach in September 2017 and acknowledged it had been ongoing since mid-May 2017.[1][3][5]

• Corporate response and oversight: Regulators and investigators criticized the company for security lapses and the speed of detection, as well as for actions following the breach, including some executives’ stock sales during the investigation period. The joint CFPB/FTC and state actions established requirements for governance, security improvements, and regular oversight as part of the settlement.[3][2]

• What consumers can do now: If you were affected, check the official settlement resources for guidance on credit monitoring options, identity monitoring services, and potential reimbursements for out-of-pocket losses. You can verify eligibility and claim status through the official settlement channels, and stay vigilant for scams exploiting breach-related information.[8][10]

Illustration: A quick timeline

• 2017: Breach occurred May–July via a web portal vulnerability; discovery announced in September; compromised data included SSNs, birth dates, addresses, and some card data.[5][3]
• 2019: Global settlement announced for up to $700 million in relief and penalties; ongoing consumer relief and monitoring established.[9][2]
• 2024–2026: Settlement administration continued; payments and ongoing oversight noted by regulators, with continued public guidance for consumers.[10]

If you’d like, I can pull the most recent official claim-acceptance figures or provide a concise checklist for steps to take if you suspect you were affected. I can also summarize the consumer-relief options under the settlement in a quick-to-use guide.